PowerShell Code Samples

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

SMOKE#SCREEN uses fake Adobe and Zoom updates, document lures, and trusted cloud services to install ScreenConnect for persistent remote access.

Dark Reading

Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks.

InfoWorld

WSL container: A quiet revolution for Windows development

Running containers on Windows has never been as easy as it should be. While there are versions of Docker Desktop and Podman ...

Microsoft

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals ...

19d

Now, even Russia’s most elite hackers are using Clickfix to infect devices

One of the Russian government’s most elite hacking groups has adopted an attack, known as Clickfix, to compromise devices belonging to sensitive organizations in Ukraine, the latter country’s CERT ...

Security Boulevard

Automated forensics and rapid evidence collection techniques for technical teams

When an incident is unfolding, the first challenge is often not analysis. It is getting reliable evidence before it disappears, changes, or becomes too expensive to collect. That is where automated ...